CVE-2025-2048 — Lana Downloads Manager < 1.10.0 - Admin+ Arbitrary File Download via Path Traversal
The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attac…
Published: 2025-04-01 · CVSS: 4.1 · CVSS 3.1
The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7